Function at 0x1400041f0
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbfd0]
mov eax, 0xc0d0
call fcn.140018d20
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0xbfc0], rax
xor r13d, r13d
mov eax, dword [0x140028fd8]
test eax, eax
je 0x140004abf
cmp eax, 0x7fffffff
je 0x140004abf
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea edx, [r13 + 0x18]
call fcn.140008160
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x13
mov qword [rsp + 0x68], 0x17
movups xmm0, xmmword [str.Updating_registry..]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400227c8]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400227d8]
mov dword [rax + 0x20], ecx
movzx eax, word [0x1400227dc]
mov word [rdx + 0x24], ax
mov word [rdx + 0x26], r13w
lea rcx, [rsp + 0x50]
call fcn.1400014f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400042f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004afb
call fcn.140009ae0
mov eax, dword [0x140028fd0]
shr rax, 1
add rax, rax
cmp rax, 0x40
jae 0x140004af5
lea rcx, [0x140028fe0]
mov word [rax + rcx], r13w
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004abf
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea edx, [rax + 0x28]
call fcn.140008160
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x24
mov qword [rsp + 0x68], 0x27
movaps xmm0, xmmword [str.Checking_registry_install_location..]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400228b0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400228c0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400228d0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1400228e0]
movsd qword [rax + 0x40], xmm0
mov word [rax + 0x48], r13w
lea rcx, [rsp + 0x50]
call fcn.1400014f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400043f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004aef
call fcn.140009ae0
mov dword [rsp + 0x38], 0x2000
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004ab4
mov edx, dword [rsp + 0x38]
shr edx, 1
mov dword [rsp + 0x38], edx
lea eax, [rdx - 1]
cmp word [rbp + rax*2 - 0x40], 0
je 0x140004462
lea rcx, [rdx + rdx]
lea eax, [rdx + 1]
mov dword [rsp + 0x38], eax
cmp rcx, 0x2000
jae 0x140004b07
mov word [rbp + rcx - 0x40], r13w
mov eax, dword [rsp + 0x3c]
cmp eax, 2
jne 0x1400044a8
mov r8d, 0x1000
lea rdx, [rbp + 0x1fc0]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x1000
ja 0x14000449f
mov r8d, eax
add r8, r8
lea rdx, [rbp + 0x1fc0]
lea rcx, [rbp - 0x40]
call fcn.14000f200
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x1400044b1
cmp eax, 1
jne 0x140004ab4
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1fc0]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x140004ab4
mov r8d, 0x2000
lea rdx, [rbp + 0x1fc0]
lea rcx, [rbp - 0x40]
call fcn.14000f200
xor r9d, r9d
lea r8, [rbp + 0x1fc0]
mov edx, 0x1000
lea rcx, [0x140022380]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x1000
jae 0x140004ab4
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea rax, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
mov rbx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004530
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x140004b01
mov eax, 0xa
lea r12d, [rax - 3]
cmp rbx, 8
jae 0x140004591
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r12
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000f200
mov word [rsp + rbx + 0x50], r13w
mov r15, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
jmp 0x1400045e9
mov r15, rbx
or r15, r12
cmp r15, r14
jbe 0x1400045a1
mov r15, r14
jmp 0x1400045a8
cmp r15, rax
cmovb r15, rax
lea rdx, [r15 + 1]
call fcn.140008160
mov r14, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r15
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14000f200
mov word [r14 + rbx], r13w
movabs r14, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x1fc0]
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140004602
cmp rdi, r14
ja 0x140004b0d
cmp rdi, 8
jae 0x140004656
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], r12
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x1fc0]
lea rcx, [rbp - 0x80]
call fcn.14000f200
mov word [rbp + rbx - 0x80], r13w
mov r13, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
mov qword [rsp + 0x40], r14
xor r8d, r8d
jmp 0x1400046af
mov r13, rdi
or r13, 7
cmp r13, r14
jbe 0x140004667
mov r13, r14
jmp 0x140004674
cmp r13, 0xa
mov eax, 0xa
cmovb r13, rax
lea rdx, [r13 + 1]
call fcn.140008160
mov r14, rax
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], r13
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x1fc0]
mov rcx, rax
call fcn.14000f200
xor r8d, r8d
mov word [r14 + rbx], r8w
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdi
cmp rax, 1
jb 0x140004b13
lea rdx, [rbp - 0x80]
cmp r13, 8
cmovae rdx, r14
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
lea rax, [rdi + 1]
lea r14, [rbp - 0x60]
cmp rax, 7
jbe 0x14000478f
mov r12, rax
or r12, 7
cmp r12, rcx
jbe 0x140004712
mov r12, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140004743
cmp r12, 0xa
mov eax, 0xa
cmovb r12, rax
lea rcx, [r12 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140004b1f
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004774
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004b1f
mov rcx, rax
call fcn.14000984c
test rax, rax
je 0x140004b19
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rdx, qword [rsp + 0x70]
jmp 0x14000478b
test rcx, rcx
je 0x140004788
call fcn.14000984c
mov r14, rax
mov rdx, qword [rsp + 0x70]
jmp 0x14000478b
mov r14, r8
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x48], r12
lea rbx, [rdi + rdi]
mov r8, rbx
mov rcx, r14
call fcn.14000f200
mov word [rbx + r14], 0x5c
xor eax, eax
mov word [r14 + rdi*2 + 2], ax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400047f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b19
call fcn.140009ae0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x140028fd0]
shr eax, 1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [0x140028fe0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x3fc0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3fc0]
mov rax, rsi
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140004854
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3fc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_FZ_LLC
lea rcx, [rbp + 0x5fc0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x5fc0]
mov rax, rsi
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400048b0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x5fc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x7fc0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x7fc0]
mov rax, rsi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140004910
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7fc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Inno_Setup:_Icon_Group
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx eax, word [rsp + 0x76]
movzx r9d, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d
lea rcx, [rbp + 0x9fc0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x9fc0]
nop dword [rax]
lea rsi, [rsi + 1]
cmp word [rax + rsi*2], 0
jne 0x140004980
lea eax, [rsi*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x9fc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallDate
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
lea rbx, str.https:__desktop.telegram.org
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HelpLink
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLInfoAbout
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLUpdateInfo
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp r13, 8
jb 0x140004a7b
lea rdx, [r13*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b25
call fcn.140009ae0
nop
cmp r15, 8
jb 0x140004ab4
lea rdx, [r15*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004aaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004aef
call fcn.140009ae0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xbfc0]
xor rcx, rsp
call fcn.140009590
lea r11, [rsp + 0xc0d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000ff34
int3
call fcn.1400096b8
int3
call fcn.14000ff34
int3
call fcn.140001200
int3
call fcn.1400096b8
nop
call fcn.140001200
nop
call fcn.140001200
int3
call fcn.14000ff34
int3
call fcn.140001160
nop
call fcn.14000ff34
int3