Function at 0x1400911e9
Capabilities:
Check if file exists
Create thread

Disassembly:
test rdx, rdx
je 0x140091564
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd10]
sub rsp, 0xe10
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe50], rbx
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0xd00], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x10]
call fcn.1402767a0
mov rcx, qword [rdi + 0xc68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
call qword [rax + 0x50]
nop
xor edx, edx
mov r8d, 0x88
lea rcx, [rsp + 0x60]
call fcn.1402767a0
mov rcx, qword [rdi + 0xc70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x50]
nop
mov rsi, qword [rbp - 0x10]
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x58], r15
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor edx, edx
mov r8d, 0xa70
lea rcx, [rbp + 0x80]
call fcn.1402767a0
lea rcx, [rbp + 0x80]
call fcn.1400b2670
nop
mov dword [rsp + 0x40], 0x80000000
mov dword [rsp + 0x38], 0x80000000
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x80b
mov r9d, 0x96c80000
lea r8, [0x14032eca8]
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.1400c5e80
lea rcx, [rbp + 0x80]
call fcn.1400c6030
mov eax, dword [rbp + 0xae8]
dec eax
cmp eax, 7
ja case.default.0x14009131f
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x91568]
add rcx, rdx
jmp rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x140091325
add eax, eax
mov dword [rsp + 0x20], eax
mov r9, r14
lea r8, str.LastKey
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit
mov rcx, 0xffffffff80000001
call fcn.14005fce0
mov r9d, 1
xor r8d, r8d
lea rdx, str._C:Windows_regedit.exe___m
lea rcx, str.C:Windows_regedit.exe
call fcn.14005e960
jmp case.default.0x14009131f
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400913ac
mov rcx, rbx
call fcn.1400b1fc0
test eax, eax
je 0x1400913ac
movzx eax, word [0x140455b60]
mov word [str.X:WindowsInstaller], ax
lea rcx, str.X:WindowsInstaller
call fcn.14004d480
jmp case.default.0x14009131f
mov rcx, rsi
call fcn.14004d480
jmp case.default.0x14009131f
lea rax, [rbx + 0x210]
lea r9, [rbx + 8]
mov qword [rsp + 0x20], rax
lea r8, [0x14032ee48]
mov edx, 0x104
lea rcx, [rbp + 0xaf0]
call fcn.14004e9f0
mov rdx, qword [rbx + 0x418]
mov rcx, qword [rdi + 8]
call fcn.140080170
test eax, eax
je case.default.0x14009131f
lea rdx, [rbp + 0xaf0]
mov rcx, qword [rbx]
call fcn.140060030
jmp case.default.0x14009131f
mov rdx, rsi
mov rcx, qword [rdi + 8]
call fcn.140080170
test eax, eax
je case.default.0x14009131f
mov rcx, rsi
call fcn.14007fea0
test eax, eax
jne case.default.0x14009131f
mov r9, rsi
lea r8, [0x14007fe60]
jmp 0x140091496
mov rdx, rbx
mov rcx, rdi
call fcn.140093bf0
jmp case.default.0x14009131f
mov rdx, rbx
mov rcx, rdi
call fcn.140093010
jmp case.default.0x14009131f
mov rdx, rbx
mov rcx, rdi
call fcn.140093880
jmp case.default.0x14009131f
mov rdx, qword [rbx + 0x418]
mov rcx, qword [rdi + 8]
call fcn.140080170
test eax, eax
je case.default.0x14009131f
mov rdx, qword [rbx + 0x480]
mov rcx, qword [rdi + 8]
call fcn.140080170
test eax, eax
je case.default.0x14009131f
mov r9, rbx
lea r8, [0x140092cc0]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rax, vtable.CUninstMenuManage.0
mov qword [rbp + 0x80], rax
lea rax, vtable.CUninstMenuManage.2.0
mov qword [rbp + 0xa0], rax
lea rax, vtable.CUninstMenuManage.4.0
mov qword [rbp + 0xb8], rax
lea rax, vtable.CUninstMenuManage.1.0
mov qword [rbp + 0xc0], rax
lea rax, vtable.CUninstMenuManage.5.0
mov qword [rbp + 0xc8], rax
lea rax, vtable.CUninstMenuManage.3.0
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0x80]
call fcn.1400657a0
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x14009152d
call fcn.14027b988
nop
lea rax, [rbp - 8]
mov rcx, qword [rbp - 0x10]
cmp rcx, rax
je 0x14009153f
call fcn.14027b988
mov rcx, qword [rbp + 0xd00]
xor rcx, rsp
call fcn.140125a70
mov rbx, qword [rsp + 0xe50]
add rsp, 0xe10
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret