Function at 0x1400b5d30
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x1b8]
sub rsp, 0x2b0
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x180], rax
cmp dword [0x14045ebc8], 0
jne 0x1400b67fb
mov qword [r11 + 8], rbx
lea r10, [0x14033bcf8]
mov qword [r11 + 0x10], rsi
lea rcx, [0x14033bd30]
mov qword [r11 + 0x18], rdi
xor esi, esi
mov qword [r11 - 0x10], r12
mov edi, esi
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x48], rsi
nop word [rax + rax]
mov ebx, esi
mov r13, rcx
mov dword [rsp + 0x40], ebx
nop dword [rax]
movsxd rax, ebx
mov r9d, 0x20019
imul rdx, rax, 0x208
lea rax, [rsp + 0x58]
mov r8d, 4
add rdx, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [r10 + rdi*8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6776
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r12d, esi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x6c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400b676b
nop word [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x68], esi
inc r12d
mov qword [rsp + 0x20], rax
mov r15, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5f10
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6711
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b868]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5f10
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b5f10
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov r15, rax
test rax, rax
je 0x1400b5f10
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], r15
lea rdx, [0x14033b868]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5f05
cmp dword [rsp + 0x68], eax
ja 0x1400b5f10
mov rcx, r15
call fcn.14012a2d4
mov r15, rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b5f20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1400b6711
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x68], esi
mov r14, rsi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6006
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6016
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b880]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6006
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b6006
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov r14, rax
test rax, rax
je 0x1400b6006
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x14033b880]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5ffb
cmp dword [rsp + 0x68], eax
ja 0x1400b6006
mov rcx, r14
call fcn.14012a2d4
mov r14, rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6016
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor edi, edi
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
lea r8d, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b60f0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6100
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b980]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b60f0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b60f0
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov rsi, rax
test rax, rax
je 0x1400b60f0
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x14033b980]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b60e5
cmp dword [rsp + 0x68], edi
ja 0x1400b60f0
mov rcx, rsi
call fcn.14012a2d4
mov rsi, rdi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6100
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x68], edi
mov rbx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b61dd
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b61ed
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b998]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b61dd
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b61dd
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b61dd
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b998]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b61d2
cmp dword [rsp + 0x68], edi
ja 0x1400b61dd
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rdi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b61ed
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
jne 0x1400b6200
test rsi, rsi
jne 0x1400b6200
test rbx, rbx
je 0x1400b670f
mov ecx, 0x4b0
call fcn.14012a618
xor edx, edx
mov r8d, 0x4b0
mov rcx, rax
mov rdi, rax
call fcn.14027b2c0
mov rax, qword [rsp + 0x48]
lea rdx, [0x14033bcf8]
mov r8d, 2
mov rcx, qword [rdx + rax*8]
lea rdx, [rdi + 8]
mov qword [rdi], rcx
mov rcx, r13
nop dword [rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x1400b6240
mov eax, dword [rcx]
lea rcx, [rdi + 0x210]
mov dword [rdx], eax
lea rax, [rsp + 0x70]
lea edx, [r8 + 2]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400b62b0
mov eax, dword [rax]
lea r9d, [rdx + 1]
mov dword [rcx], eax
lea r8d, [rdx + 4]
mov qword [rdi + 0x458], rsi
lea rax, [rsp + 0x50]
xor esi, esi
mov qword [rdi + 0x430], rbx
mov qword [rdi + 0x418], r15
lea rdx, [rsp + 0x70]
mov qword [rdi + 0x428], r14
mov ebx, esi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b63ff
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b640f
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b9c8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b63ff
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b63ff
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b63ff
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b9c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b63f4
cmp dword [rsp + 0x68], esi
ja 0x1400b63ff
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b640f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x448], rbx
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov r9d, 1
mov qword [rsp + 0x50], rsi
mov rbx, rsi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b64f3
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6503
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b9e8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b64f3
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400b64f3
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b64f3
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b9e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b64e8
cmp dword [rsp + 0x68], esi
ja 0x1400b64f3
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b6503
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
mov qword [rdi + 0x450], rbx
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
lea r8d, [r9 + 3]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6578
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6588
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rsp + 0x68]
lea rdx, [0x14033b908]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6588
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov dword [rdi + 0x460], eax
mov r9d, 1
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
lea r8d, [r9 + 3]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6600
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6610
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rsp + 0x68]
lea rdx, [0x14033b928]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6610
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov dword [rdi + 0x464], eax
mov r9d, 1
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
lea r8d, [r9 + 3]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6688
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6698
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rsp + 0x68]
lea rdx, [0x14033b950]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b6698
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x468], eax
call fcn.1400b3b50
xor edx, edx
mov qword [rdi + 0x480], rax
mov rcx, rdi
call fcn.1400b43b0
mov rcx, rdi
mov qword [rdi + 0x488], rax
call fcn.1400b6820
test eax, eax
jne 0x1400b66f2
mov rcx, qword [rdi + 0x480]
test rcx, rcx
je 0x1400b66f2
movzx eax, word [0x14045e53c]
cmp word [rcx], ax
je 0x1400b66f2
mov rcx, rdi
call fcn.14012a2d4
jmp 0x1400b6711
mov rcx, qword [0x14045d7e8]
mov r9d, 1
mov r8, rdi
mov edx, 0x659
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400b6711
xor esi, esi
xor edx, edx
mov dword [rsp + 0x6c], 0x104
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.14027b2c0
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov edx, r12d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400b5e30
mov ebx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
lea rcx, [0x14033bd30]
add r13, 0x208
mov dword [rsp + 0x40], ebx
lea r10, [0x14033bcf8]
cmp ebx, 2
jb 0x1400b5db0
mov eax, dword [rsp + 0x44]
lea rcx, [0x14033bd30]
inc eax
lea r10, [0x14033bcf8]
inc rdi
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x48], rdi
cmp eax, 2
jb 0x1400b5da0
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x2d0]
mov rsi, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x2b0
pop rbp
ret