Function at 0x140009f80
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
jmp 0x140009f80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x140058188]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x38]
mov rbp, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIA_nView_Desktop_Manager
xor r12d, r12d
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdi, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0x104
lea rsi, [0x14004c2c0]
test eax, eax
jne 0x14000a0d8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.InstallLocation
xor r8d, r8d
mov dword [rsp + 0x34], 0x208
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a0c4
mov rcx, rbx
lea rax, [rsp + 0x40]
nop dword [rax]
cmp word [rax], di
je 0x14000a051
add rax, 2
sub rcx, 1
jne 0x14000a040
jmp 0x14000a0a5
test rcx, rcx
je 0x14000a0a5
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0x40]
je 0x14000a09d
mov r9, rsi
lea r8, [rcx + rdx + 0x7ffffefb]
sub r9, rax
test r8, r8
je 0x14000a098
movzx edx, word [r9 + rax]
test dx, dx
je 0x14000a098
mov word [rax], dx
add rax, 2
dec r8
sub rcx, 1
jne 0x14000a077
jmp 0x14000a09d
test rcx, rcx
jne 0x14000a0a1
sub rax, 2
mov word [rax], r12w
lea rcx, [rsp + 0x40]
mov r8, rbp
mov edx, 0x208
call fcn.14000135c
lea rcx, [rsp + 0x40]
call fcn.140016a50
mov rdi, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
jne 0x14000a1e3
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a1e8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.InstallLocation
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a1d3
mov rcx, rbx
lea rax, [rsp + 0x40]
cmp word [rax], r12w
je 0x14000a167
add rax, 2
sub rcx, 1
jne 0x14000a155
jmp 0x14000a1b4
test rcx, rcx
je 0x14000a1b4
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [rsp + rdx*2 + 0x40]
je 0x14000a1ac
lea rcx, [rbx + rdx + 0x7ffffefb]
sub rsi, rax
test rcx, rcx
je 0x14000a1a7
movzx edx, word [rsi + rax]
test dx, dx
je 0x14000a1a7
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x14000a187
jmp 0x14000a1ac
test rbx, rbx
jne 0x14000a1b0
sub rax, 2
mov word [rax], r12w
lea rcx, [rsp + 0x40]
mov r8, rbp
mov edx, 0x208
call fcn.14000135c
lea rcx, [rsp + 0x40]
call fcn.140016a50
mov rdi, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x14000a1e8
mov rax, rdi
jmp 0x14000a1f0
mov rcx, rbp
call fcn.140016b60
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017ca0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret