Function at 0x1400301b0
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x14008b180]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rbp + 0x2b0], r15
lea r12, [0x140000000]
lea rax, [r12 + 0x8b1c8]
mov qword [rbp + 0x2b8], rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2c0]
call fcn.140030ba0
nop
mov esi, dword [rbp + 0x2b0]
mov rcx, qword [0x14008b1d0]
mov rax, qword [rbp + 0x2b8]
cmp qword [rax + 8], rcx
jne 0x140030b22
test esi, esi
jne 0x140030b22
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x250]
call fcn.1400311a0
mov rsi, qword [0x14008e5b0]
lea rdi, [r15 - 1]
mov rbx, qword [rbp + 0x260]
cmp byte [rbx + 0x19], r15b
jne 0x140030306
lea rax, [rbx + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140030285
mov rax, qword [rax]
lea r9, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae r9, qword [rbp + 0x2c0]
mov r11, qword [rbp + 0x2d0]
mov rcx, r11
cmp r10, r11
cmovb rcx, r10
test rcx, rcx
je 0x1400302f0
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x1400302f5
sub r9, rax
cmp dx, r8w
ja 0x1400302e9
cmp rcx, 1
je 0x1400302f0
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400302c7
mov eax, edi
jmp 0x1400302ff
mov eax, 1
jmp 0x1400302ff
cmp r11, r10
jae 0x1400302f9
mov eax, edi
jmp 0x1400302ff
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
je 0x140030309
mov rbx, rsi
cmp rbx, rsi
jne 0x1400304e1
lea rax, [r12 + 0x76b70]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x68], rax
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xd8], 4
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.logger_stream.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x5c], edx
mov ecx, dword [0x14008e500]
mov eax, dword [0x14008e504]
add ecx, eax
je 0x14003041f
mov dword [rsp + 0x40], r15d
call fcn.140017d60
mov qword [rsp + 0x38], rax
lock inc dword [rsp + 0x40]
mov dword [rsp + 0x30], 0xa
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x140030400
call fcn.140017d60
mov qword [rsp + 0x38], rax
lock inc dword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14003041f
mov rax, qword [rax + 0x58]
test rax, rax
je 0x14003041f
call qword [case.0x14002be35.0]
movzx ebx, al
jmp 0x140030421
xor bl, bl
mov eax, dword [rsp + 0x30]
test al, 8
je 0x140030459
and eax, 0xfffffff7
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r15
mov eax, edi
lock xadd dword [rsp + 0x40], eax
cmp eax, 1
js 0x140030454
call fcn.14001db10
mov eax, edi
lock xadd dword [rsp + 0x40], eax
cmp eax, 1
jns 0x140030442
lock inc dword [rsp + 0x40]
mov byte [rbp + 0xe0], bl
mov dword [rbp + 0xe4], 4
lea rax, str.GetUninstallString
mov qword [rbp + 0xe8], rax
test bl, bl
je 0x1400304be
lea rdx, str.unknown_appid_suffix
lea rcx, [rbp + 0x60]
call fcn.140029060
movzx ebx, byte [rbp + 0xe0]
test bl, bl
je 0x1400304be
lea rdx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae rdx, qword [rbp + 0x2c0]
mov r8, qword [rbp + 0x2d0]
lea rcx, [rbp + 0x60]
call fcn.140031a50
nop
lea rcx, [rbp + 0xf8]
call fcn.140002890
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov esi, 0x1f
jmp 0x140030b22
mov qword [rbp + 0x288], r15
mov qword [rbp + 0x298], r15
mov qword [rbp + 0x2a0], 7
mov word [rbp + 0x288], r15w
mov r8d, 0x34
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rbp + 0x288]
call fcn.14002d2e0
nop
lea rcx, [0x14008e588]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x14008e580], 0
jne 0x140030538
call fcn.14002d4a0
lea rcx, [0x14008e588]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x14008e580]
test rcx, rcx
je 0x14003056a
mov rax, qword [rcx]
lea r8, str.BASE
mov edx, dword [rbx + 0x40]
mov rax, qword [rax + 0x30]
call qword [case.0x14002be35.0]
jmp 0x140030571
lea rax, str._error_interface_not_inited_
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140030574
mov rdx, rax
lea rcx, [rbp + 0x288]
call fcn.140018310
mov qword [rbp + 0x268], r15
lea rdx, [rbp + 0x288]
cmp qword [rbp + 0x2a0], 8
cmovae rdx, qword [rbp + 0x288]
lea rax, [rbp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x1400307c4
lea rax, [r12 + 0x76b70]
mov qword [rsp + 0x68], rax
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], 0x20
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x68], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x64], edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x20], 4
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea rax, vtable.logger_stream.0
mov qword [rsp + rcx + 0x68], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x64], edx
mov ecx, dword [0x14008e500]
mov eax, dword [0x14008e504]
add ecx, eax
je 0x1400306e5
mov dword [rsp + 0x50], r15d
call fcn.140017d60
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov dword [rsp + 0x30], 0xa0
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400306c6
call fcn.140017d60
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
cmp qword [rax], 0
je 0x1400306e5
mov rax, qword [rax + 0x58]
test rax, rax
je 0x1400306e5
call qword [case.0x14002be35.0]
movzx ebx, al
jmp 0x1400306e7
xor bl, bl
mov eax, dword [rsp + 0x30]
test al, al
jns 0x140030727
btr eax, 7
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x48], r15
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x140030722
nop dword [rax]
call fcn.14001db10
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x140030710
lock inc dword [rsp + 0x50]
mov byte [rbp - 0x18], bl
mov dword [rbp - 0x14], 4
lea rax, str.GetUninstallString
mov qword [rbp - 0x10], rax
test bl, bl
je 0x1400307ac
lea rdx, str.RegOpenKeyEx
lea rcx, [rsp + 0x68]
call fcn.140029060
movzx ebx, byte [rbp - 0x18]
test bl, bl
je 0x1400307ac
lea rdx, [rbp + 0x288]
cmp qword [rbp + 0x2a0], 8
cmovae rdx, qword [rbp + 0x288]
mov r8, qword [rbp + 0x298]
lea rcx, [rsp + 0x68]
call fcn.140031a50
cmp byte [rbp - 0x18], 0
je 0x1400307ac
lea rdx, str._failed
lea rcx, [rsp + 0x68]
call fcn.140029060
cmp byte [rbp - 0x18], 0
je 0x1400307ac
mov edx, esi
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rbp]
call fcn.140002890
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140030abf
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x270], xmm1
mov qword [rbp + 0x280], r15
mov edx, 0x7fff
lea rcx, [rbp + 0x270]
call fcn.14002d740
mov qword [rbp + 0x270], rax
lea rbx, [rax + 0xfffe]
mov qword [rbp + 0x280], rbx
xor edx, edx
mov r8d, 0xfffe
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x278], rbx
mov rcx, qword [rbp + 0x270]
sub rbx, rcx
sar rbx, 1
lea eax, [rbx + rbx]
mov dword [rbp + 0x2a8], eax
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x14003087b
mov rdx, qword [rbp + 0x270]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140030861
mov r8, rdi
mov rcx, r14
call fcn.14002d2e0
jmp 0x140030a55
lea rax, [r12 + 0x76b70]
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], 0x200
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x158]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x158], rax
mov rax, qword [rbp + 0x158]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x154], edx
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x1c8], r15
mov dword [rbp + 0x1d0], 4
mov rax, qword [rbp + 0x158]
movsxd rcx, dword [rax + 4]
lea rax, vtable.logger_stream.0
mov qword [rbp + rcx + 0x158], rax
mov rax, qword [rbp + 0x158]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x154], edx
mov ecx, dword [0x14008e500]
mov eax, dword [0x14008e504]
add ecx, eax
je 0x1400309af
mov dword [rsp + 0x60], r15d
call fcn.140017d60
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov dword [rsp + 0x30], 0xa00
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140030990
call fcn.140017d60
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
cmp qword [rax], 0
je 0x1400309af
mov rax, qword [rax + 0x58]
test rax, rax
je 0x1400309af
call qword [case.0x14002be35.0]
movzx ebx, al
jmp 0x1400309b1
xor bl, bl
mov eax, dword [rsp + 0x30]
bt eax, 0xb
jae 0x1400309ec
btr eax, 0xb
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x58], r15
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x1400309e7
call fcn.14001db10
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x1400309d5
lock inc dword [rsp + 0x60]
mov byte [rbp + 0x1d8], bl
mov dword [rbp + 0x1dc], 4
lea rax, str.GetUninstallString
mov qword [rbp + 0x1e0], rax
test bl, bl
je 0x140030a3c
lea rdx, str.RegQueryValueEx_UninstallString_failed
lea rcx, [rbp + 0x158]
call fcn.140029400
movzx ebx, byte [rbp + 0x1d8]
test bl, bl
je 0x140030a3c
mov edx, esi
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call fcn.140002890
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x140030abf
mov rax, qword [rbp + 0x280]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030aa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067440
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], r15
mov rdx, qword [rbp + 0x2a0]
cmp rdx, 8
jb 0x140030b08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030b03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030b03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067440
mov qword [rbp + 0x298], r15
mov qword [rbp + 0x2a0], 7
mov word [rbp + 0x288], r15w
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 8
jb 0x140030b6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030b66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030b66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067440
mov eax, esi
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1400673e0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret